If you are looking for a LastPass alternative, you probably have a reason: the 2022 breach, price changes, or simply wanting something different. This page explains what happened in plain terms, what to look for in a replacement, and where NettForge fits. Checked October 2026. Companies change plans and features, so confirm the details on their own sites.
What happened in 2022
In December 2022, LastPass told customers that attackers had copied backups of customer vault data. According to LastPass's own updates, the copied data included customers' encrypted vaults, along with some information that was not encrypted at the time, such as website addresses. Encrypted data is still protected by each customer's master password, which is why LastPass advised strong master passwords. The practical lesson for anyone choosing a manager is to ask exactly what a provider would hold in the worst case.
What to look for in a replacement
- Zero-knowledge, with details. Which key-derivation method, and with what settings?
- Everything encrypted. Website addresses and item names are valuable to an attacker too. Ask what is stored in the clear.
- A slow key method. Argon2id or a high-iteration PBKDF2 makes stolen data expensive to attack.
- Honest recovery. A reset that the provider can do for you can also be done for an attacker. Prefer recovery kits and trusted contacts.
- Transparency. Clear security pages, and a company that explains problems when they happen.
How NettForge handles it
Every NettForge item (its name, website address, username, password and notes) is sealed on your device with AES-256-GCM and a fresh random value before it is synced. The key is made from your master password with Argon2id (64 MiB, 3 passes, 4 lanes). The server can see that an item exists, its type (for example a login) and when it changed, and nothing about what is inside. There is no password reset that we can perform, so you get a Recovery Kit, and Personal plans add emergency access. The full design is on our security page, with a plain-English guide in what is a zero-knowledge password manager.
An honest note. NettForge is new. LastPass, 1Password and Bitwarden have been around for many years. If a long track record matters most to you, look at Bitwarden or 1Password too. We would rather you choose well than choose us.
Moving your logins from LastPass
- In LastPass, open Advanced Options and choose Export. Save the CSV file.
- In NettForge, open the menu, choose Import and Export, then Bring your passwords over and pick LastPass.
- Check your logins, then delete the CSV file, because it is readable by anyone.
- Turn off LastPass autofill in your browser and keep the old account for a month before closing it.
The full walk-through, including 2FA codes, is in how to switch password managers without losing a login. A free NettForge account is the easiest way to try it. See the comparison table for the others.
Questions people ask
That is your call, and it depends on your risk. LastPass disclosed in December 2022 that attackers copied customers' encrypted vault backups, along with some unencrypted data such as website addresses. Many people have since moved. If you stay, use a long, unique master password and check your account's settings. If you move, switching takes minutes.
A zero-knowledge design with a modern slow key-derivation method, every field encrypted (including website addresses), clear information about what the company can still see, and a way to recover your account that does not weaken the lock.
Yes. Export a CSV from LastPass (Advanced Options, then Export), import it in NettForge, then delete the CSV. See how to switch.